CVE-2026-4563 - MacCMS Member Order Detail User.php order_info authorization

Back Back to CVE browser

MEDIUM

MacCMS Member Order Detail User.php order_info authorization

Published Mar 22, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.37%

Description

A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User.php of the component Member Order Detail Interface. This manipulation of the argument order_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

Vendor Maccms Product MacCMS Default
n/a
- Version
  2025.1000.4052
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Maccms

MacCMS

n/a

Version	Status	Constraints
2025.1000.4052	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-285

CWE-639

Authorization Bypass

References (4)

https://github.com/HuajiHD/CVE/issues/10
exploitissue-tracking
https://vuldb.com/?ctiid.352400
signaturepermissions-required
https://vuldb.com/?id.352400
vdb-entrytechnical-description
https://vuldb.com/?submit.775050
third-party-advisory

Link	Providers	Tags
https://github.com/HuajiHD/CVE/issues/10		exploitissue-tracking
https://vuldb.com/?ctiid.352400		signaturepermissions-required
https://vuldb.com/?id.352400		vdb-entrytechnical-description
https://vuldb.com/?submit.775050		third-party-advisory